aws configure sso showing nothing / not working

[bouteillerAlan]

I have tried to use aws configure sso but it shows absolutely nothing on my console (kitty) neither on xterm or konsole.

aws configure seem to work

After fetching the doc I entered each value in the same order and my config file was generated but now if I do aws s3 ls I got Unable to locate credentials. You can configure credentials by running "aws configure"..

My config file:

❯ cat .aws/config
[profile mainpu]
sso_session = ssopu
sso_account_id = xxxx
sso_role_name = PowerUserAccess
region = eu-west-1
output = json
[sso-session ssopu]
sso_start_url = https://xxxx.awsapps.com/start/#
sso_region = eu-west-1
sso_registration_scopes = sso:account:access

If I do a aws sso login I got the link and so on but that change nothing on aws s3 ls.

PowerUserAccess is the default policies from aws: https://docs.aws.amazon.com/aws-managed-policy/latest/reference/PowerUserAccess.html

aws --version
aws-cli/2.31.18 Python/3.13.7 Linux/6.17.5-arch1-1 source/x86_64.endeavouros

[bouteillerAlan]

Has part of the experimentation, I found that using sso_account_id and sso_role_name in the default section of the config file allow me to successfully connect.

The downside of that is that I can't use aws sso login --profile to switch profile, this config seems to force me to use the default one.

Any of the other solution doesn't work at all:

• aws sso login then aws sso login --profile mainpu then aws s3 ls give an error
• deleting the sso cache and just aws sso login --profile mainpu then aws s3 ls give an error
• aws configure or aws configure sso do nothing new
• aws sso logout either

[uldyssian-sh]

Your SSO profile looks fine. The main issue is that you are running aws s3 ls without selecting the SSO profile, so the CLI is using the default profile (which has no credentials), hence “Unable to locate credentials”.

Log in and run commands using the same profile:

aws sso logout --profile mainpu

rm -rf ~/.aws/sso/cache

aws sso login --profile mainpu

aws s3 ls --profile mainpu

If you want aws s3 ls to work without --profile, set the profile for your shell session:

export AWS_PROFILE=mainpu

aws s3 ls

About aws configure sso “showing nothing”: it’s not required. You can configure SSO by editing ~/.aws/config (as you already did). The key is that SSO credentials are only used when you run commands under that profile (--profile mainpu or AWS_PROFILE=mainpu).

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊

[bouteillerAlan]

Hello, thanks for your message.

"About aws configure sso “showing nothing”: it’s not required. You can configure SSO by editing ~/.aws/config" yes, but actually this is still an issue since the cli isn't working has intended (we can't see any of the prompt when the cmd launch).

For the login, is aws sso login --profile xxx not supposed to allow me to login to a specific profile? Because that part of the problem for me, or at least a (very) bad UX choice.

I removed the cache, remove the default profile in the config then aws sso login --profile staging (the config has staging and sandbox for profile), the browser tell me to log (id, password, oauth and so on), still aws s3 ls doesn't work. But like you say with --profile this command work.

In the help aws say: --profile (string) Use a specific profile from your credential file. so in my head I don't have to use --profile when I do a command after login with a specific profile. If I'm forced to use --profile after aws sso login --profile what's the diff between this command and aws sso login? And what's the use case?